Create an account, pick a plan

• Visit the site → Sign up. If the operator has email configured you will confirm your address; otherwise the account is ready immediately.
• Free gets you a working channel. Streamer / Pro / Business unlock more viewers, SRT, DVR, encryption, DASH, failover and white-label — upgrade any time on the Billing page.
• Everything you own lives under Dashboard (/app).

Create a channel, point your encoder at it

Dashboard → New channel → name it → Create
The channel card shows your INGEST KEY — treat it like a password.

Use yuv420p — exotic pixel formats (4:4:4, 10-bit) are rejected at the handshake with a clear reason, because browsers cannot hardware-decode them.

Playback URLs come ready-made

• The channel's Share & play card has everything click-to-copy: watch page, HLS .m3u8, a responsive 16:9 embed, and — when your plan enables them — DASH manifest and more.
• HLS plays everywhere: browsers (built-in player), VLC, ffplay, smart TVs, set-top boxes.
• Multi-bitrate: push several renditions (<KEY>_1080p, <KEY>_720p…) — the master playlist assembles itself and players switch quality automatically.

AES-128 + signed tokens — two locks, one door

• Channel → Edit → Secure. That's the entire setup: segments are AES-128 encrypted on the fly and every request needs a signed, expiring ?token=.
• The built-in player and embeds handle tokens automatically. For your own site: mint tokens via /api/playback-token and append to the URL — works in hls.js, Safari, VLC.
• Tokens can be IP-bound: a copied link dies on arrival. Rotate AES key retires a leaked key instantly; viewers re-join within seconds.
• Also available: geo allow/deny by country, referer rules, viewer caps.

Rewind live, keep forever

• DVR: set a rewind window (up to 240 min on Business) — viewers scrub back through live; the player shows GO LIVE · -1m20s and one click returns to the edge.
• Record to VOD: every broadcast finalizes into a playable recording the moment the encoder disconnects. The Recordings table lists each with its ID, copyable .m3u8 URL and embed snippet.
• Integrators: GET /api/stream-info/<slug> returns the recordings array with ready-made URLs.

Redundant ingest failover — Business

# encoder A (primary)
… -f flv "rtmp://your-host:1935/live/<KEY>_720p?p=10"
# encoder B (hot standby — second machine / second uplink)
… -f flv "rtmp://your-host:1935/live/<KEY>_720p?p=5"

• Same key, two encoders: highest priority holds the air; if it drops or freezes, the standby takes over within seconds behind one clean discontinuity.
• Auto-failback: when the primary returns healthy, it reclaims the air after a hold window (no flapping).
• Watch the election live: GET /api/ingest.

Faster glass-to-glass, more device reach

• LL-HLS (~2 s): same playlist URL — capable players negotiate partial segments automatically, everyone else gets standard HLS from the same address.
• DASH/CMAF: /dash/<slug>/manifest.mpd for players and devices that prefer MPEG-DASH.
• Both toggle per-channel on the Edit page (Business).

White-label custom domains — Business

• Dashboard → Custom domains → add tv.yourbrand.com.
• DNS: an A record to the server's IP (or CNAME to its hostname). The TLS certificate issues itself on the first HTTPS visit.
• Cloudflare users: gray cloud (DNS only) at least until the certificate is issued — the orange proxy intercepts the challenge.
• Your domain then serves your channels with your branding and none of the platform marketing.

Analytics that survive restarts

• Per-channel: live concurrents, peak, bandwidth, devices/OS/players, countries and cities (live) and countries · this period (persisted per-minute, restart-proof).
• History charts: requests, concurrency, Mb/s per minute.
• Operators additionally get Business metrics: MRR, ARPU, churn, revenue by month, the signup→paying funnel, platform-wide geography and watch time.

Run the whole SaaS from two panels

The Health page is the truth-teller: TLS expiry, database reachability, GeoIP, SMTP, HTTP/3 state — red items tell you exactly what to fix and how.

Stripe, PayPal, Square — live in an afternoon

• Paste credentials in Admin → Settings, press Verify per provider, done — checkout uses whatever verifies green.
• Webhooks keep subscription state honest: activations, renewals, cancellations and failed payments land automatically (past_due shows the customer a banner).
• The admin guide's Payments section documents every provider step-by-step: where to create keys, which webhook events, how signatures are verified, sandbox→live migration.

Upgrade the binary. Nobody notices.

cp ssh101-new /usr/local/bin/ssh101
systemctl reload ssh101        # = kill -USR2 → FD handover

• The new process inherits the live sockets and the streams' in-memory windows; playlists keep the same sequence lineage; encoders reconnect behind one discontinuity. Measured: zero refused connections across chained upgrades.
• Plain restarts are safe too (warm restart): viewers ride through on their buffers.
• qa/e2e.sh in the repository re-proves the whole system — 18 checks — before any deploy.

Stream on.

Full manuals live at /docs (broadcasters) and /docs/admin (operators).
This deck: /present — share it, or press P for a printable/PDF copy.